chore(deps): align pnpm minimumReleaseAge with dependency firewall#5919
Merged
Conversation
The release pipeline's `pnpm install --frozen-lockfile` was failing with ERR_PNPM_FETCH_451 because the Dependency Firewall (firewall.depthfirst.com) quarantines newly published package versions for 7 days and returns HTTP 451 for them. With `minimumReleaseAge: 0`, pnpm applied no cooldown of its own, so Dependabot bumps pinned the lockfile to versions younger than the firewall's window (e.g. knip 6.27.0, lucide-react 1.25.0, @swc-node/register 1.12.0, @posthog/core 1.43.1), which the firewall then refused to serve. Set `minimumReleaseAge` to 10200 minutes (7 days + a 2-hour buffer) so pnpm only ever resolves versions old enough for the firewall to serve, and re-resolve the lockfile onto firewall-approved versions. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Qp5ihFoD67CTcAAEr5js7
avallete
changed the title
avallete
enabled auto-merge
July 21, 2026 14:38
Coly010
approved these changes
Jul 21, 2026
Contributor
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@569b225a32acf908c33a3d08eb7824e413f8e676Preview package for commit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The release pipeline's
pnpm install --frozen-lockfilewas failing withERR_PNPM_FETCH_451. The Dependency Firewall (firewall.depthfirst.com) quarantines newly published package versions for 7 days and returns HTTP 451 "Unavailable For Legal Reasons" for them.With
minimumReleaseAge: 0, pnpm applied no cooldown of its own, so Dependabot bumps pinned the lockfile to versions younger than the firewall's window (e.g.knip@6.27.0,lucide-react@1.25.0,@swc-node/register@1.12.0,@posthog/core@1.43.1), which the firewall then refused to serve — breaking the install.This sets
minimumReleaseAgeto 10200 minutes (7 days + a 2-hour buffer; the setting is in minutes) so pnpm only ever resolves versions old enough for the firewall to serve, keeping pnpm's floor in lockstep with the firewall. The lockfile is re-resolved onto firewall-approved versions (knip@6.26.0,lucide-react@1.24.0,@swc-node/register@1.11.1,@posthog/core@1.40.2, …).The buffer was kept at exactly 2 hours rather than a larger margin on purpose: a value stricter than the firewall would reject exact-pinned bleeding-edge previews (e.g.
next@16.3.0-preview.6inapps/docs) that the firewall itself would still serve.Linked issue
Closes #
open-for-contributionlabel (or I'm a Supabase maintainer).Checklist
fix(cli): …).pnpm check:allandpnpm testpass for the workspace(s) I touched.https://claude.ai/code/session_019Qp5ihFoD67CTcAAEr5js7